FIX: Autoplay videos must always be muted (#11533)

This automatically adds the muted attribute if it's missing in a video
tag.

Co-authored-by: David Taylor <david@taylorhq.com>

app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js

@@ -168,6 +168,38 @@ module("Unit | Utility | sanitizer", function () {
     );
   });
 
+  test("autoplay videos must be muted", function (assert) {
+    let pt = new PrettyText(buildOptions({ siteSettings: {} }));
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay src="http://example.com/music.mp4"/>`
+        )
+        .match(/muted/)
+    );
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay muted><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+    assert.notOk(
+      pt
+        .sanitize(
+          `<p>Hey</p><video><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+  });
+
   test("poorly formed ids on headings", function (assert) {
     let pt = new PrettyText(buildOptions({ siteSettings: {} }));
     assert.equal(

app/assets/javascripts/pretty-text/addon/allow-lister.js

@@ -225,7 +225,7 @@ export const DEFAULT_LIST = [
   "track[srclang]",
   "ul",
   "video",
-  "video[autoplay]",
+  // video[autoplay] handled by sanitizer.js
   "video[controls]",
   "video[controlslist]",
   "video[crossorigin]",

app/assets/javascripts/pretty-text/addon/sanitizer.js

@@ -126,6 +126,12 @@ export function sanitize(text, allowLister) {
           return "-STRIP-";
         }
 
+        if (tag === "video" && name === "autoplay") {
+          // This might give us duplicate 'muted' atttributes
+          // but they will be deduped by later processing
+          return "autoplay muted";
+        }
+
         // Heading ids must begin with `heading--`
         if (
           ["h1", "h2", "h3", "h4", "h5", "h6"].indexOf(tag) !== -1 &&